Privacy notice
Version 1.0 · effective 3 October 2026. PaymentsDatabase is operated by MEGHR LTD, which is the controller of everything described here.
A profile on this site is meant to be found — that is the whole point of it — so what you put on your profile is public. Everything else is not: your email address, your messages, what you applied to and what you paid are yours. We do not sell personal data, we do not build advertising profiles from it, and you can take a copy of everything we hold or delete the lot from your account page, without asking us.
What is public, and what is not
Public: your profile — name, photo, headline, employer, country and city, the methods, markets, licences, industries, skills and languages you list, your work history as you have entered it, whether a work email was confirmed and when, and anything you post publicly. Search engines can index it unless you turn visibility off in your profile settings.
Not public: your email address, your password, your messages, your tender applications, your credit balance and purchases, and who you are connected to. A merchant sees your application only because you sent it to them.
Seen by the person you looked at: opening a profile records a view. Pro members can see the name behind it. If that is not what you want, do not open the profile — we would rather say so plainly than bury it here.
What we hold, why we are allowed to, and for how long
| What | Detail | Lawful basis | Kept for |
|---|---|---|---|
| Account | Name, email address, password (hashed), sign-in times, two-factor secret if you turn it on. | Contract — we cannot give you an account without it. | While the account exists. |
| Public profile | Everything you choose to put on it: headline, employer, country, methods, markets, skills, languages, photo, links. | Contract, and your own decision to publish it. | Until you change or delete it. |
| Work email verification | The address you confirmed, its domain and the date. | Legitimate interests — a badge nobody checks is worth nothing. | While the claim is shown; the address itself is not published. |
| What you write | Posts, pops, comments, reactions, messages, tender applications. | Contract. | Until you delete it or close the account. |
| Credits | Purchases, grants and what each credit was spent on. | Contract, and a legal obligation to keep accounting records. | Six years, with your name removed once the account is closed. |
| Profile analytics | That your profile was opened or appeared in a search, and the day it happened. For Pro members, who opened it. | Legitimate interests — the product is lead generation, and we tell you up front that a profile view is visible. | 13 months, then only the daily totals. |
| Technical logs | IP address, user agent and the request, for rate limiting and abuse. | Legitimate interests — keeping the site up. | 30 days. |
Where we rely on legitimate interests you can object, and we will either stop or explain why we cannot. Where we rely on consent — only marketing email — you can withdraw it at any time and it costs you nothing else.
Who else sees it
We do not sell personal data and we do not share it with anyone to advertise to you elsewhere. These are the services that process data on our behalf, under contract:
| Service | What for | Where |
|---|---|---|
| DigitalOcean | Servers and database, in Frankfurt. | EU |
| Cloudflare | DNS, TLS and protection in front of the site. | Global, EU-first routing |
| Resend | Transactional email — verification links, alerts. | EU/US, standard contractual clauses |
| Stripe | Card payments for credits. We never see your card number. | EU/US, standard contractual clauses |
| Google AdSense | Advertising, where a slot is not sold directly. | EU/US, standard contractual clauses |
Transfers outside the UK and EEA are covered by the UK addendum to the standard contractual clauses. We will also disclose data where the law requires it, and we will tell you when we are allowed to.
Your rights, and where to use them
Under the UK GDPR and the EU GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, and take it elsewhere. Two of those are buttons rather than requests:
- A copy of everything — your account page gives you one JSON file with your profile, posts, messages, applications and credit history.
- Deletion — the same page closes the account and deletes your profile, posts, messages and applications. Records of credits bought stay on the books for accounting, with your name removed from them.
- Correction — edit your profile; anything else, write to us.
- Objection, restriction, or anything else — write to us and we will answer within one month.
If you think we have got it wrong you can complain to the Information Commissioner’s Office (ico.org.uk) or to your own supervisory authority in the EEA.
Cookies
We set no analytics or advertising cookies of our own. What the site stores is:
- Your sign-in token and your theme, held in your browser’s local storage, not sent to anyone.
- A cookie recording that you have passed the password on the People half while it is in preview.
- Cloudflare’s own security cookie, which is strictly necessary to keep the site up.
- Where an advertising slot is filled by Google AdSense rather than sold directly, Google may set cookies under its own policy. House creatives — the ones we sell ourselves — run in a sandboxed frame and set nothing.
Age
This is a professional network for people working in payments. It is not for under-18s, and we do not knowingly hold data about them.
Contact
MEGHR LTD, England and Wales. Privacy questions and requests: [email protected]. For anything about the service itself, see the terms of use.
If we change this notice we will update the version and the date above, and tell account holders by email where the change is material.